RE: Patch: Fix user authentication + MKDB

[Pankaj K Garg]

> > ...
> >    plain text for passwords with a $0$ prefix,
> >    MD5 format for passwords with a $1$ prefix, and
> >    DES format for passwords without a prefix.
> 
> IMHO this is better than default=plaintext-passwords.

Yes. I'll fix this in the patch tomorrow.

> > ...
> ... why not give them empty passwords ? As in:
> 
>          foo:$0$test:edit:
>          *::view:
> 
> Then the behavior IMHO should be:
>  - user foo gives correct password  --> 'edit' access
>  - user foo gives wrong password    --> no access
>  - user foo gives no/empty password --> 'view' access
>  - user bar gives any password      --> no access
>  - user bar gives no/empty password --> 'view' access
> 
> Would that be possible ?

 I see your point: If the user mis-types his password, and we
silently give them read access, they don't know what happened.
I'm in favor of your solution--should be possible to implement.

 Regards

Pankaj